Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 21:02
Static task
static1
Behavioral task
behavioral1
Sample
271f41547ce2e2f9f22a06edd3924494_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
271f41547ce2e2f9f22a06edd3924494_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
271f41547ce2e2f9f22a06edd3924494_JaffaCakes118.html
-
Size
41KB
-
MD5
271f41547ce2e2f9f22a06edd3924494
-
SHA1
a0de2b31270f166d82ba5052f9541cf5eaaafa9b
-
SHA256
c395571d12af77a7f4427610cc17d514286d5cc0759a8f8eb987b02b36a47742
-
SHA512
9941740c889e2532a0510d850aaa05339da119b84c9c83dfc3f0a502fa695ab1f9e8b6e842f3fcfddce199dd0e71a6cc69a5926e6be187b559f399881abdb015
-
SSDEEP
768:XQdZhempDxrzMTU8oyR92VeRohs9a6Htd:XQgPSeRys9aI
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e74164d8261e55408e727bfeb5bee9e10000000002000000000010660000000100002000000022c37b8375ef72caa423c33969c538888f184bd7748bfbd6dd54c5267001e8f2000000000e8000000002000020000000201e5841110b15e678fba1213ec6d08bfe115baf4761ce0e3cdd22d540fd9d8d90000000c06ee0354a4c352dea2fdb337b6149cf2f79730e5dcde66574e0a6d5d31fac8e454ad0a2e1f4c67bb528b74860ba240fdb44de66b35b86a8b4f47c691353b5b16b08f5e65cd315d3b2b121f1ec5ff0f91100847bfcde5fc9554500e8248477a5ced89035a5ff58a5e6231ed6c89355c213165d4e62dd143de9a142ee4679374ca67b1c2ba0a8347fe7bf84889a105e6c40000000f900586f6ffa0d3ad0de2ee86d12c4db7b62c578b51bdc344ce7f84e55634391a8d13a4a454f3b57327b88b7780c5a01777482a5d90301846d4308aa164444a3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e74164d8261e55408e727bfeb5bee9e100000000020000000000106600000001000020000000f1842474da4fde1d71e729cecc234045b52997f7ef703b52576149a48dc81168000000000e8000000002000020000000ec58e007e0e7633a18cdd990c301bc9765119734321fe53cf6c099765b8397c6200000000c20013cfcf914d2a58be1988c13343145e7a742fe184e37827692487a5561b140000000769b4ca7e147d3fbae303a2ef2acdf9ddbb1e44adaf385a3704c46bc05630403b54495ce08ea1b23715d87d926c49fbd4747c896cae4153a3436244826780af0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426375235" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECAADC31-3B11-11EF-8F92-565622222C98} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60951c001fcfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2868 iexplore.exe 2868 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2956 2868 iexplore.exe 28 PID 2868 wrote to memory of 2956 2868 iexplore.exe 28 PID 2868 wrote to memory of 2956 2868 iexplore.exe 28 PID 2868 wrote to memory of 2956 2868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\271f41547ce2e2f9f22a06edd3924494_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD540403773dff073bafa69e77b61411b36
SHA1e111dafdff77267eed52756af6feed777354b3a8
SHA2565a6bf72207bc2da0af59a261ef6454b1c5627a6f60ab33cc89898aa97e1ea158
SHA512950ef2e56bb9ed85d39c7ba968f53d6cb07dc94efad82a741131d8cd2f93cacaf1b9ca700437ff455d78bb735e14158491ca05d9ac2e7d0c3a19a84d7cdd1946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD546208d8406f3ac1b8cb9081388aecbba
SHA1734d89403f0cb4914fb5f09f5900a5a5ed106e03
SHA2562fd128bd3b3f3f91f33034696070ef8c1869dbdfc91a5e62858b268e199b0a5e
SHA512d2697cda8e42525bc422ebde31fa0dba09b5f2ebd21af217b54d2affa84e48952763fc5bac3d717353e8e09370673aa70302daf2486a2a7540d90e7c8db1a377
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5510c7e4d9e5c56e79e67b1a0fb07bf5d
SHA110db5d8f697ac4e2d95cf71d4740caa374811ed1
SHA256407cc8dd1569b420a464c65b69d00b705ba598c5094640926d0d25363bd1114b
SHA51270ecbbbb41cd89189a05804f894c013f835fdde87cfb9697e4f67dda0190256a8ef4bd91e2fc91c7e6379fd185f88c9ff54cc87ab92a3af1aac5a368d8e9ce0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b8a0b976d87d467e5ff1eeda9f6c0ddf
SHA10d42949b1601f58675dd47f211f724378ef3649a
SHA256cb2b690263225d5a6566eaadd177b3dfb3198ffa07bbda3bed3c329278f6c3c2
SHA5121959a0964e158e0ed913217c51147ee22dddda03853fcc38b6c69059a98c70f73f3ba48bd538d1c68f0ae4e1949600772b87b1ea2c9311b1261650e8a77fac86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59da76cc22bd5e5950270a5981f10b617
SHA1e50281eccb4b813f3d29ff409505811f8eafd195
SHA256e2b16b15154e41820b4d1f96b0c3e76e1e804249c4d6eb6d77e34e6d282ba728
SHA512aa1028addbce123e0488f32e0952687e94f3b5b669447d5a7e0e524a8cfe9e10b555aeebafbeeb4d4178efe6c03623da9ba4bddb31fe76ee5d4553c0e88eb5b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bb4974fbddcffe2829c33969a3659154
SHA18784b0a3b03dff76220af5347e12ac84e455b8d2
SHA2568346e6497c9ab051056bb43161d24c4b8ea739d58409096f9420c6affaaa82f2
SHA512370cb39a2aabc3b0e344826de2a2f88b746495fc437442a795f13a3bb4fc976c9e5c8ec68230449179e08ea206671c27013943aa359cd5e69989bd4a08436414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51121be1cd009490ecb568031c136ba82
SHA145eece724e9d48428184d506d4792b26967d8322
SHA256046f8dcad49868bde6234c53ed211222db4e71ded593934b241711ff02b1a2a2
SHA5128f2af411021712d9052dc49324f1f616e1534bd073c40cac4648b96d1a0bb16111bcef6353c7d958c7055abb55e90b168b224d431f4debc109068df2f4264f47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b036c364c45677f564d529316c19c60d
SHA1a8ee82b0a43231fb28abe7d028b4b47146a8fd4a
SHA2564758ab058d1fc58e2c3dc7f3a04b4a37a8e55c17b1be6ad0fa523f855c597f7d
SHA5128b741bd8f155365d7080c80868921356bfed5a8961ba9e3161df8d5bb2dd909fa1fcb26fb63b679d12747bdd6224fa0e73faf5ac06825e777bf191fee02d28fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5644a72d4570a007c0bd4bc2f2d8fe2ae
SHA1fd39546a24fe2a43778abeb40c414dc8c1a5d6e5
SHA25626de20f760119858c3df4bd64e6b2c6e0f8d7897cd46d3107765bef265498249
SHA512e05289986112eedc60e4a051da47dc884c80e2caaaf3cc8f465c9b05d852b72029744885f515bf07a5b5adeb7360092993a852ca948752cc43b0a037dd2847e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5032b3bbcfdf59f707ae72e6a619ab2c3
SHA1038a5f87550b3d6f8184ae6d9d49e3aeb5021ac8
SHA2566adae2cd9864d24f1e4bbbaa82c308758e0dac0add51dd92766e63a3403d9da0
SHA51297484d44d5dfbc552e86c8220413cbf4a18828dea435750651cb3d6a158d649dc1754b8d5f8c23b67212338df2637b22d066f89461320926c036641710fac2ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD547cb6e07b35bc2c287e27101016cf856
SHA1a6171474e05b90e6163ec6d8de7362284c69dfbd
SHA256178b0846424bbd505647f95799f3e05087704e04feabd6e34ce78cad4c41904a
SHA5128b4b05f589c8e2499777cabb4f467e1fd4b44cdb706367eb835b3f2d0949ba4fc8c90305be7e6d96b3ad71881e21dc25e2cb92a5c99044d78b7f14145a697644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51d364b0bacf3fc35523f544945d3ebc5
SHA1b00d83b6af8447e1fc01c33299523a4df4c19b62
SHA256975db8382db7c4f39325c2eda5ccd7ee9478ca50e202177cd5c349c8a92509e7
SHA512d8f299b957d0abc2e3d4eaf23931de72be472525db63cde51fbcb84e8bf53eb13565467ca9f4a403a55ad1b47f6475a1cca9e67436d5d1df77d7556ac67bce99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD504cc98ed15c2fc6ab230407bcc9380a9
SHA1043d870cab96ead8357ea30104decf611987b976
SHA2569ed9649dad117c413dcd94fd04c39ec76cb7ccd715c066d8363112600324d82f
SHA5122bc1fad2541140a19f7ffd957800f18ff685a3ca8076011a69248aaf1eb977eaa6970518207c8ad9579c66eb96f27da3c9c8e32ec30e881036094d76c476023e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5defbbc32872a425e4696e93a95659712
SHA1ec3d32f5259a01fd4226141ff5e71b72b4d8bf14
SHA256b92f11a04400bd6a6a399e1f3ed13ce7c27470e27df1d08e863bdb4d34a4e677
SHA5124c53e8d42587f2bad58d7aee0dde03da16cc60f89a20d1144989cf2153275d7167b8ab7162af171db2a30ee0f599aac5bf3e117c95cc0bc34410cbcf04a53072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f252766e2bf3338b37a7b7f26b3fef76
SHA148757843d7c6b0736f7bb1456d78b447c409a1c1
SHA256b5f2bd0e5940f6d8e024f199482fca489d23b016287cc73410543529b80e62bc
SHA512c31e0aaa13dcbec494f6cbdbb6e86c5dcd3c9526dee0880eed6424ce1871a5a195b516acad7dfcbe1273c863596693d4748c6fec425f1618b60bba1482aab908
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD540e7cdd9a4b40f7b0c8862ac53c055ff
SHA164cd4ac36ae4a4ad7c4abcf31901a6629141d6bd
SHA2565021c1ea748809ef52e460f239723dda5b7f06bf797ee7a7c6bc8b70a64f6541
SHA512a495d70fcf444fa836ad1620a85bb47af152804813b2c1e4d1fee7a36bd41c94112ccbc45059047d601e5ad77d0d0168b539c81520c30ac07e035a25f8bb687a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50db6cc2428e7e0674841697fb38ca49a
SHA1b446736a16200294c3e865676c39d661ee110ffb
SHA256b3ba54af83623d19441e5ebd3844fec9346f73c8013e402d79e51a2b56a1d0bf
SHA51214839fbb3421f269c0b133273df4aba2df82db2423f998a1517b2a6e82603a379cc26bee2ad13e0c6276653705a5ce9c71601514f40197910f4005b9f75dca70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57ad510f96f001ea2f6991c7655f9c677
SHA1f4934d514c9693f03367dafdb9e65093def5dbe3
SHA256c5ba06b6caaf69c0195bbb0e67f857c1525b139a643c1d810eb4741324e66e79
SHA5122e26d03d29ca330790a2b1f6e0244f05f5aadf14a958d354a9a87521fbfb81439913f4467fb76625cec91730d3f7fed3ca744e7d96aafd1c397c4ab7b4ada350
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b